Preamble

This privacy policy explains which personal data ("data") we process, for what purposes and to what extent. It applies to the provision of our services, to our website trulyxd.com and to our social media profiles (together, our "online services").

The terms used are not gender-specific.

As of: 21 October 2026

Jennifer Moss, Truly XD Studio B 7, 2 68159 Mannheim Deutschland

E-Mail: sayhello@trulyxd.com

Legal notice (Impressum): trulyxd.com/legal-notice

We have not appointed a data protection officer, as there is no legal obligation to do so. For any questions about data protection, please contact us directly at the email address above.

The following overview summarises the types of data processed, the data subjects concerned and the purposes of processing. Details are set out in the respective sections.

Types of data processed: master data; contact data; content data; contract data; payment data; usage data; meta, communication and procedural data; log data; image, video and audio recordings.

Categories of data subjects: clients and service recipients and their contact persons; prospective clients; communication partners; business and contractual partners; participants in research studies, surveys and video conferences; users of our online services.

Purposes of processing: initiating, providing and invoicing our services; conducting UX research; communication and scheduling; office, organisational and administrative procedures; accounting and compliance with legal obligations; provision and security of our online services; audience measurement; surveys and feedback; public relations.

Automated decision-making: We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We process data on the basis of the following legal grounds under the GDPR. The basis that applies in each case is stated in the respective section.

• Consent (Art. 6(1)(a) GDPR): The data subject has given consent to the processing for one or more specific purposes.
• Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract with the data subject or for taking steps at their request prior to entering into a contract.
• Legal obligation (Art. 6(1)(c) GDPR): Processing is necessary for compliance with a legal obligation, in particular retention obligations under commercial and tax law.
• Legitimate interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by the interests or fundamental rights of the data subject.

National law in Germany: In addition, the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) apply, in particular Section 25 TDDDG on storing and accessing information on end devices.

Swiss Federal Act on Data Protection: For persons in Switzerland, we also process personal data in accordance with the Swiss Federal Act on Data Protection ("FADP"). Personal data is processed lawfully, in good faith and proportionately (Art. 6(1) and (2) FADP), and is collected only for a specific purpose that is evident to the data subject (Art. 6(3) FADP). This policy uses the terminology of the GDPR ("processing", "personal data", "legitimate interest", "special categories of data"). Within the scope of the FADP, their meaning is determined by the FADP.

In accordance with Art. 32 GDPR, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. In doing so, we take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing.

These measures include, in particular, controlling access to data and devices, encrypted data transmission, data backups and procedures for exercising data subject rights and for deletion. We take data protection into account when selecting software and services.

TLS encryption: Our website is delivered exclusively via encrypted HTTPS (TLS). You can recognise this by the prefix "https://" in your browser's address bar.

We only disclose data where this is necessary for the purposes stated. Recipients are mainly the service providers named in this policy and our tax adviser. With service providers who process data on our behalf, we conclude data processing agreements in accordance with Art. 28 GDPR.

• Third countries: Some service providers are based outside the EU or the EEA. Data is only transferred there if the requirements of Art. 44 et seq. GDPR are met:
• Switzerland: The European Commission has adopted an adequacy decision for Switzerland.
• USA: For companies certified under the EU-U.S. Data Privacy Framework (DPF), the European Commission's adequacy decision of 10 July 2023 applies. The list of certified companies is available at dataprivacyframework.gov. For providers that are not certified, we base the transfer on the European Commission's standard contractual clauses.

The applicable basis is stated for each service. General information is available from the European Commission.

• Proton AG, Switzerland, Adequacy decision (Switzerland)
• hundertzehn GmbH (Moco), Switzerland, Adequacy decision (Switzerland)
• Figma, Inc., USA, Data Privacy Framework
• Umami Software, Inc., USA, Standard contractual clauses (Module 2, part of the data processing agreement)
• LinkedIn Ireland Unlimited Company, Ireland, onward transfer to the USA, Data Privacy Framework, standard contractual clauses

Transfers abroad under the Swiss FADP: We only disclose personal data of persons in Switzerland abroad if adequate protection is ensured (Art. 16 FADP). The member states of the EU and the EEA are recognised as adequate by the Swiss Federal Council (list, in German). For certified companies in the USA, the Swiss-U.S. Data Privacy Framework applies, recognised since 15 September 2024. Otherwise, we use standard data protection clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC).

We delete data as soon as the purpose no longer applies, consent is withdrawn or there is no other legal basis. This does not apply to data we must retain for legal reasons or need for the establishment, exercise or defence of legal claims. We process such data only for that purpose. Where several retention periods apply to the same data, the longest one prevails. Any deviating periods are stated in the respective section.

Retention periods under German law:

• 10 years/b>: Books and records, annual financial statements, inventories, management reports, opening balance sheet and related work instructions
• 8 years: Accounting vouchers, e.g. invoices and expense receipts
• 6 years: Business letters received and sent and other records relevant for tax purposes
• 3 years: Data needed to defend or assert contractual claims (standard limitation period)

Retention periods under Swiss law:

• 10 years: Accounting records, vouchers, invoices and related organisational documents
• 10 years (5 years in certain cases): Data needed to defend or assert contractual claims

Start of periods: Periods of one year or more begin at the end of the calendar year in which the triggering event occurred. For ongoing contracts, this is the termination of the contract.

Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions. Where we process your data for direct marketing purposes, you may object at any time without giving reasons. An informal message to sayhello@trulyxd.com is sufficient.

Rights under the GDPR (Art. 15 to 21 GDPR):

• Withdrawal of consent: You may withdraw any consent given at any time with effect for the future.
• Access: You may request confirmation as to whether we process data about you, and access to that data and a copy of it.
• Rectification: You may request the rectification of inaccurate data or the completion of incomplete data.
• Erasure and restriction: You may request the erasure of your data or the restriction of processing in accordance with the law.
• Data portability: You may receive data you have provided to us in a structured, commonly used and machine-readable format, or have it transmitted to another controller.
• Complaint: You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

Rights under the Swiss FADP: You have the right to access, to the release or transfer of your personal data in a common electronic format, to rectification, and to object to the processing and request the erasure or destruction of your personal data. You may also contact the Federal Data Protection and Information Commissioner (FDPIC).

Obligation to provide data: Providing your data is not required by law. However, without the information needed for a contract or a request, we cannot process the request or conclude the contract.

We process the data of our clients, prospective clients and their contact persons in order to initiate, provide and invoice our services. Our services include UX strategy and consulting, experience design, accessible design, UX research, workshops and ongoing support.

• Types of data processed: master data, contact data, contract data, content data from our collaboration (e.g. briefings, feedback, project documents), payment data, communication data.
• Data subjects: clients and their contact persons, prospective clients, business and contractual partners.
• Purposes: preparing offers, performing contracts, project organisation, time tracking, invoicing, accounting, compliance with legal obligations.
• Recipients: the service providers listed under "Cloud, organisation and accounting services" and our tax adviser.
• Legal bases: performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR) where the data subject is a party to the contract; legitimate interests in communicating with contact persons of our clients (Art. 6(1)(f) GDPR); statutory retention obligations (Art. 6(1)(c) GDPR).
• Retention: We store contract and project data until the limitation periods expire, and accounting vouchers and business letters until the statutory retention periods expire (see "Retention and deletion").

Processing on behalf of clients: Where we process personal data on behalf of our clients, for example data of their customers, users or research participants, we act as a processor under Art. 28 GDPR. The respective client is then the controller, and their privacy notices apply.

As part of UX research, we conduct interviews, usability tests, surveys and similar studies. In doing so, we process information provided by participants and, where agreed in advance, image, audio and screen recordings.

Research on behalf of clients: Where we conduct studies for clients, the client is the controller. We act as a processor on the basis of an agreement under Art. 28 GDPR. Participants receive separate privacy information before the study, usually in the client's name. We store recordings only temporarily locally on our devices in order to transcribe them. We then hand over recordings and transcripts to the client and delete them from our systems.

Our own research studies: Where we conduct studies for our own purposes, we are the controller.

• Types of data processed: master data, contact data, content data (answers, observations, notes), image, video and audio recordings, meta and communication data.
• Data subjects: participants in research studies.
• Purposes: conducting and evaluating the study, scheduling sessions.
• Legal basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time with effect for the future.
• Retention: We delete recordings once the evaluation is complete. We only use evaluated results further in anonymised form.
• Services used: Proton Meet, Typeform, Proton Drive (each described below).

Our website runs on the content management system Wagtail, which we operate ourselves on servers of manitu GmbH. No data is transmitted to the developers of the CMS.

Server log files: When you visit the website, the server automatically stores access data: the page or file requested, date and time, amount of data transferred, status message, browser type and version, operating system, referrer URL and IP address. We use this data to deliver the website, ensure its stability and defend against attacks. Log files are deleted or anonymised after about 21 days. Data needed to investigate a security incident is retained until the incident has been resolved.

Cookies and access to end devices: Our website does not set any cookies for visitors and does not access information on your end device beyond what is strictly necessary for its operation (Section 25(2) TDDDG).

Fonts: All fonts are hosted on our own server. No connection to external font providers is established when you load a page.

Version control and backups: We version and back up the website's code and content on servers of Hetzner Online GmbH.

Email: Our mailboxes are operated by manitu GmbH. When you write to us, manitu processes the content, sender, recipient and time of your message on our behalf.

• Types of data processed: usage data, meta, communication and procedural data, log data; for emails also contact and content data.
• Data subjects: website users, communication partners.
• Purposes: provision, stability and security of the website; data backup; email communication.
• Legal basis: legitimate interests in a secure and functional online service and in email communication (Art. 6(1)(f) GDPR).

Services used:

• manitu: web hosting and email hosting; provider: manitu GmbH, Welvertstraße 2, 66606 St. Wendel, Germany; website; privacy policy; data processing agreement: provided by the provider.
• Hetzner: servers for version control and backups; provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; website; privacy policy and data processing agreement: data protection at Hetzner.

To understand which content on our website is used, we use the analytics service umami Cloud. umami works without cookies and without comparable persistent identifiers on your end device. It does not create user profiles and does not track you across other websites.

To count visits, umami creates a hash value from the IP address, browser identifier and domain together with a random value that changes daily. This hash does not allow any conclusions about your identity and does not allow recognition beyond the same day. The IP address itself is not stored. Only aggregated information is stored, such as pages viewed, time spent, referrer, device type, browser, operating system and country.

• Types of data processed: usage data, meta and procedural data (IP address only briefly, to create the hash).
• Data subjects: website users.
• Purpose: audience measurement and improvement of our online services.
• Legal basis: legitimate interests in a data-minimising analysis of the use of our website (Art. 6(1)(f) GDPR).
• Objection: You may object to this processing under Art. 21 GDPR (see "Your rights").

Service used: umami Cloud; provider: Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, CA, USA; website; privacy policy; data processing agreement; transfer mechanism: EU/EEA – standard contractual clauses (Module 2), Switzerland – standard contractual clauses adapted for the Swiss FADP; both are part of the data processing agreement.

Contacting us: When you contact us by email, phone, post or via social networks, we process your information in order to answer your request.

Appointment booking: You can book an introductory call via our booking page on Proton Calendar. We process the information you provide when booking (usually name, email address and preferred time) in order to organise the appointment.

Video conferencing: We hold meetings, workshops and research sessions via Proton Meet. This involves processing display names, video and audio transmission, chat messages, screen sharing and technical connection data. According to the provider, audio, video, chat and screen sharing are end-to-end encrypted and are not stored by the provider after the call. Sessions are only recorded if we announce this in advance and you consent.

During video conferences, please protect the privacy of your surroundings and do not share access links with unauthorised third parties.

• Types of data processed: master data, contact data, content data, meta, communication and procedural data; for video conferences also video and audio transmissions.
• Data subjects: communication partners, prospective clients, clients and their contact persons, participants.
• Purposes: answering requests, scheduling, conducting meetings and workshops.
• Legal bases: pre-contractual measures and performance of a contract (Art. 6(1)(b) GDPR); legitimate interests in efficient communication, in particular with contact persons of organisations (Art. 6(1)(f) GDPR); consent for recordings (Art. 6(1)(a) GDPR).
• Retention: We delete requests once they have been fully dealt with and no contract is concluded, at the latest after 12 months. Business letters are retained within the statutory periods.

Services used:

• Proton Calendar: calendar and appointment booking, invitations, reminders; provider: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; website; privacy policy; data processing agreement; transfer mechanism: European Commission adequacy decision (Switzerland).
• Proton Meet: encrypted video conferencing; provider: Proton AG (see above); website; privacy policy; data processing agreement; transfer mechanism: European Commission adequacy decision (Switzerland).

We use Typeform for surveys, feedback requests and research questionnaires. Depending on the survey, answers are collected anonymously or with personal data. Before each survey begins, we inform participants whether and which personal data is requested.

• Types of data processed: content data (answers), usage and metadata; for surveys with personal data also master and contact data.
• Data subjects: participants in surveys and research studies.
• Purposes: feedback, surveys, UX research.
• Legal bases: consent for surveys and research questionnaires involving personal data (Art. 6(1)(a) GDPR); legitimate interests for anonymous surveys, insofar as data such as the IP address is processed for technical delivery (Art. 6(1)(f) GDPR). For research on behalf of clients, the section "UX research" applies.
• Retention: We delete answers containing personal data once the evaluation is complete or after handover to the client.

Service used: Typeform; provider: TYPEFORM SL, Carrer Bac de Roda, 163, local, 08018 Barcelona, Spain; website; privacy policy; data processing: governed by Section 4 of Typeform's privacy policy; transfer mechanism: standard contractual clauses, insofar as sub-processors outside the EU are used.

We use the following services for storing files, collaborating on designs, time tracking, invoicing and accounting. The providers process the data on our behalf.

• Types of data processed: master data, contact data, content data (documents, designs, comments), contract data, payment data, usage and metadata; for research projects in Proton Drive, temporarily also image and audio recordings.
• Data subjects: clients and their contact persons, prospective clients, business and contractual partners, participants in research studies.
• Purposes: project organisation and collaboration, time tracking, invoicing, accounting, collaboration with our tax adviser.
• Legal bases: performance of a contract (Art. 6(1)(b) GDPR); legitimate interests in efficient office organisation (Art. 6(1)(f) GDPR); statutory retention obligations for accounting data (Art. 6(1)(c) GDPR).
• Retention: as set out under "Provision of our services" and "Retention and deletion".

Services used:

• Proton Drive: encrypted storage and sharing of files; provider: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; website; privacy policy; data processing agreement; transfer mechanism: European Commission adequacy decision (Switzerland).
• Figma: design, prototyping and collaborative editing with comment and version history features; provider: Figma, Inc., 760 Market St FL 10, San Francisco, CA 94102, USA; website; privacy policy; data processing agreement: provided by the provider; transfer mechanism: EU/EEA and Switzerland – Data Privacy Framework.
• Moco: project management, time tracking, quotes and invoices; provider: hundertzehn GmbH, Aeschstrasse 131F, 8123 Ebmatingen, Switzerland; website; privacy policy; data processing agreement; transfer mechanism: European Commission adequacy decision (Switzerland).
• DATEV: accounting, exchange of documents and collaboration with our tax adviser; provider: DATEV eG, Paumgartnerstr. 6–14, 90429 Nuremberg, Germany; website; privacy policy; data processing agreement: provided by the provider.

We use the AI assistant Claude as a tool, for example to structure, draft and review our own texts and concepts. We always review the results ourselves before using them.

We do not enter any personal data of our clients, their contact persons, research participants or other third parties into Claude. Nor do we enter any confidential information of our clients. Your personal data is therefore not processed by the AI service.

Service used: Claude; provider: Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA; website; privacy policy.

We maintain profiles on social networks in order to communicate with interested parties and inform them about our work. Data may be processed outside the EU, which may make it harder to enforce your rights. The network operators generally also process usage data for advertising and market research purposes and use cookies for this. Details and opt-out options are available in the privacy notices of the respective operators.

You can exercise your right of access and other data subject rights most effectively directly with the operator, as only the operator has access to the user data. We are happy to support you with this.

• Types of data processed: contact data, content data, usage data, meta and communication data.
• Data subjects: users of the networks.
• Purposes: communication, feedback, public relations.
• Legal basis: legitimate interests in communicating via social networks (Art. 6(1)(f) GDPR).

Networks used:

• LinkedIn: We are jointly responsible with LinkedIn (Art. 26 GDPR) for the collection of data from which LinkedIn creates statistics about our page ("Page Insights"). This includes information on content viewed and interactions, device data such as IP address, browser and language settings, and profile information such as job function, industry and company size. LinkedIn has committed in a joint controller agreement to fulfil data subject rights. Your rights are not restricted by this. Any further processing, including transfer to LinkedIn Corporation in the USA, is the sole responsibility of LinkedIn. Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; website; privacy policy; opt-out; transfer mechanism: Data Privacy Framework, standard contractual clauses.
• Bluesky: decentralised social network; provider: Bluesky, PBLLC, Seattle, USA; website; privacy policy.
• Xing: professional network; provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; website; privacy policy.

We update this privacy policy as soon as changes to our data processing make this necessary. If this requires any action on your part, such as consent, we will inform you separately. Addresses and contact details of the providers named may change. Please check them before contacting a provider.

• Personal data: any information relating to an identified or identifiable natural person, for example by reference to a name, an identification number, location data or an online identifier.
• Processing: any operation performed on personal data, such as collection, storage, analysis, transmission or erasure.
• Controller: the person or body which, alone or jointly with others, determines the purposes and means of processing.
• Processing on behalf (processor): the processing of personal data by a service provider on behalf of and on the instructions of the controller.
• Master data: information for identifying and managing contractual partners, such as name, address and customer number.
• Contact data: information enabling communication, such as email address, phone number or postal address.
• Content data: content created in communication or collaboration, such as texts, documents and images, together with related information such as authorship and time of creation.
• Contract data: information about the contract, such as subject matter, term, prices and payment terms.
• Payment data: bank details, invoices and payment history.
• Usage data: information about the use of our online services, such as pages viewed, time spent, device type and operating system.
• Meta, communication and procedural data: information about the circumstances of processing, such as IP addresses, timestamps and persons involved.
• Log data: events automatically recorded in systems, such as access times and error messages in server log files.
• Audience measurement: the analysis of how many visits an online service receives and which content is used.